From 52a713fdd0a30e1bd79818e2e3c4ab44ddca1a94 Mon Sep 17 00:00:00 2001 From: "Dmitry V. Levin" Date: Sun, 7 Jan 2018 02:03:41 +0000 Subject: linux: make getcwd(3) fail if it cannot obtain an absolute path [BZ #22679] Currently getcwd(3) can succeed without returning an absolute path because the underlying getcwd syscall, starting with linux commit v2.6.36-rc1~96^2~2, may succeed without returning an absolute path. This is a conformance issue because "The getcwd() function shall place an absolute pathname of the current working directory in the array pointed to by buf, and return buf". This is also a security issue because a non-absolute path returned by getcwd(3) causes a buffer underflow in realpath(3). Fix this by checking the path returned by getcwd syscall and falling back to generic_getcwd if the path is not absolute, effectively making getcwd(3) fail with ENOENT. The error code is chosen for consistency with the case when the current directory is unlinked. [BZ #22679] CVE-2018-1000001 * sysdeps/unix/sysv/linux/getcwd.c (__getcwd): Fall back to generic_getcwd if the path returned by getcwd syscall is not absolute. * io/tst-getcwd-abspath.c: New test. * io/Makefile (tests): Add tst-getcwd-abspath. --- io/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'io/Makefile') diff --git a/io/Makefile b/io/Makefile index 09b4f46..2117cb6 100644 --- a/io/Makefile +++ b/io/Makefile @@ -71,7 +71,7 @@ tests := test-utime test-stat test-stat2 test-lfs tst-getcwd \ tst-mknodat tst-mkfifoat tst-ttyname_r bug-ftw5 \ tst-posix_fallocate tst-posix_fallocate64 \ tst-fts tst-fts-lfs tst-open-tmpfile \ - tst-copy_file_range \ + tst-copy_file_range tst-getcwd-abspath \ # This test includes the compat implementation of copy_file_range, # which uses internal, unexported libc functions. -- cgit v1.1